Law & Disorder —

Thank you for not viewing: “Hidden” display ads hurt Web ad networks

Researcher finds at least 2% of US Web ads are stuffed in invisible webpages.

A 3-D representation of a webpage used to deliver "invisible" display ads, with stacked ad spaces that visitors never see. Pages like these get stuffed into small ad slots in legitimate websites through ad networks.

There's more than one way to fleece people using Web advertising. Botnets have been harnessed to generate fake clicks by injecting fake links into search results and to click randomly on webpages the infected computer's user never sees. But fraudsters are starting to get more sophisticated in their efforts to get rich off Web advertising.

As Dr. Douglas de Jager, CEO of Spider.io, reported in a blog post today, fraudulent advertising networks are now acting as middlemen between advertising networks placing Web display ads and those stuffing whole hidden webpages of ads into ad slots on legitimate sites. Instead of using bots, this sort of ad fraud uses real humans to generate the traffic—but it never actually shows them the ads that are served up to them.

Display advertising fraud targets ads that are paid for by pageview rather than by click. The use of real-time bidding to auction ad space on websites through exchanges such as Google's DoubleClick Ad Exchange and Microsoft's AdECN has made it possible for fraudulent ad traders to purchase an ad slot through one exchange and then sell it multiple times across others. They "fulfill" all those ads by putting them onto a webpage that gets served up within an ad slot on a legitimate site—with most of its ads hidden from view.

Because the page is "displayed" within the ad frame (again, even though the ads are invisible to the person viewing the page), the ads are often reported back as viewable to the advertiser, so the fraudulent ad trader gets paid for the impression. This works because some ad networks measure impressions based on whether an ad would be visible within the geometry of the Web browser rendering the page—not based on whether it was in fact visible. The fraud can be scaled up dramatically by stacking multiple nested iframe elements within the page of ads, with ads of different dimensions piled on top of each other. As de Jager demonstrated, one entity currently selling hidden ad slots—YieldZone.com— manages to stack 72 display ads into a hidden page, with 60 of them in position to be reported as "viewable" in a full-screen browser display.

While this is currently less of a problem than the botnet-based click and display fraud that Spider.io attributed to the Chameleon botnet, de Jager said that ad hiding affects at least two percent of the Web advertising in the US.

Hidden ads can also potentially pose a security issue to visitors to the sites that end up delivering them by delivering malicious code in a frame that is concealed within an ad or is overlaid on a legitimate ad that users might click on. An example of another approach to hiding ads pointed to by de Jager is an invisible iframe that follows the user's mouse and captures mouseclicks to redirect the user to another site. This could be used to launch malicious websites as well as for ad fraud.

Hahaha...in this day and age, most folks can "tune out" the ADs on a webpage automatically. I for one always shop on need basis and this kind of advertising is fruitless with me. What sells more is probably to show actual value than bombarding senses. Did we not learn anything from the fact that brute-force attacks are less effective on passwords?

Is this something that the ad-network can do on it's own, or does the site owner need to build their site to enable this behavior.

Put another way, if I build a legitimate website, and make the mistake of using a not-so-legitimate ad service, can they take the banner spot I've allocated for them and run code through it to generate a multitude of hidden ads?

edit: reread; and i believe the following sentence indicates that these hidden ads can be injected without knowledge of the site owner, but the wording is a little unusual and i'm not sure what "those" is doing here (maybe supposed to be "then"): "fraudulent advertising networks are now acting as middlemen between advertising networks placing Web display ads and those stuffing whole hidden webpages of ads into ad slots on legitimate sites"

Internet ads are a total "house of cards". Besides adblock, I also block flash. I don't like the idea of those flash ads running while I'm trying to read something. The wiggling is a distraction. And who knows what malware lurks in a flash ad.

Hahaha...in this day and age, most folks can "tune out" the ADs on a webpage automatically.

Excellent point. I actually had to look around to see where Ars' keeps their ads. Still don't want to "Submit My Website Free" whatever the hell that means. Although while I have ads un-adblocked here Flash blocker caught a few of the more annoying ones.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

Then website designers need to start implementing static ad images (or even animated GIFs) that are pre-printed in the HTML (maybe using XSLT) without the need for JavaScript or Flash.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some that it's these ads that infect your PCs with drive by malware and display big annoying flash ads with full sound and that these ads allow high quality content to be available to you for free? Does it occur to you that you are slowly destroying the system that pays for Igor's salary in Siberia somewhere? Think of Igor please!

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

As much as I like sites like Ars (indeed, there are very few sites like Ars, despite being zillions of sites taking money from ads), I would like even more a world wide web not overwhelmingly made by people who are in it for the money, as it used to be at its beginnings. I suspect many geeks&nerds would agree, and those are pretty much the only kind of people who could be moved by a moral/normative argument about such matters. Therefore, trying to shame people into not using ad-block softwares is unlikely to work very well.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

As much as I like sites like Ars (indeed, there are very few sites like Ars, despite being zillions of sites taking money from ads), I would like even more a world wide web not overwhelmingly made by people who are in it for the money, as it used to be at its beginnings. I suspect many geeks&nerds would agree, and those are pretty much the only kind of people who could be moved by a moral/normative argument about such matters. Therefore, trying to shame people into not using ad-block softwares is unlikely to work very well.

The fact that you're good with technical issues doesn't mean you have to be blind to basic economics.

OTOH, those advertising networks won't just stop using dancing/blinking/whatever-annoying-movement-they're-using-this-year ads for kicks, nor will they use less-intrusive advertising techniques willingly. I don't complain about advertisements in magazines and newspapers because they don't jump off the page, don't jump in front of the article I'm trying to read, don't play music or start talking randomly, etc.

It's strange that advertisers using technology to their advantage (more profitable, more efficient, more effective, etc.) is often presented as a good thing by the same people who metaphorically shake their fingers at individuals using technology to their advantage (those advertising companies will lose money and the internet as you know it will collapse!). That is, I really don't care about whether or not the internet as I know it survives; it's changed radically since I started using it (before the WWW, in fact). All I really care about is being able to do useful/fun/interesting things.

I will generally pay for those things, incidentally. It's unfortunate that most websites don't even give the option for ad-free subscriptions.

Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy?

Outstanding. Can't wait for said system to finish its inevitable implosion. Paid-for-by-advertising is a sucky model with far too many nasty implications and conflicts of interest in it, and the sooner it finishes dying a horrible death, the better.

really dacif sites placed ads correctly and did not use flash or html5 ads, no one would block them

my self I have click to play or load plug ins on demand ticked (chrome and opera) so I never see flash based ads just the place holders for me to click on (i am looking at you ars with Flash ads that i never see use static you get more views of them)

I do not use ad block apart from youtube (I am not waiting 10-30secs to start an video) or I manually black list all intelli text ads and o have blocked all ads on 1 site that have banned me forums twice (hardocp talk about ad blocking results in an ban lol the owner likes his ad money)

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

Yup, blame the victims - I block not because I don't want to see the ads, (if they behave and don't take up too much screen space I really don't care) but because of the number of viruses that they sneak into the ads on legitimate sites. Then the Ad company claims it's not their fault that someone changed the ad after they approved it. Or hijacked the adspace. Then there are those that pop up over something I am trying to read forcing me to figure out how to turn them off - often resulting in me just closing the page without reading and black listing that site altogether. Pop unders that I have to take the time to close after I close the website - The advertising companies are cutting their own throat with their greed. Hey advertisers Insult my intelligence with a POS ad and then expect me to actually spend money on your crap if there is some alternative? Fat chance.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

I don't fool around without a condom, I don't browse possibly untrustworthy sites without adblock.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

As much as I like sites like Ars (indeed, there are very few sites like Ars, despite being zillions of sites taking money from ads), I would like even more a world wide web not overwhelmingly made by people who are in it for the money, as it used to be at its beginnings. I suspect many geeks&nerds would agree, and those are pretty much the only kind of people who could be moved by a moral/normative argument about such matters. Therefore, trying to shame people into not using ad-block softwares is unlikely to work very well.

The fact that you're good with technical issues doesn't mean you have to be blind to basic economics.

I am not particularly technical, but I think I understand a minimum of basic economics. What you don't seem to gather from my previous argument is that IF the consequences of a certain activity, or lack thereof, are NOT considered to be bad by your target audience, THEN the "economic" argument won't constitute a reason for engaging (or not) in that activity.If I don't care for, or even would prefer, an internet without all the activities currently supported by advertisement, then the fact that my blocking advertising could conceivably contribute to the demise of said activities does not give me any reason to allow advertisement.

On the other hand, if a website would want to block people with ad-blockers, it could do so (albeit not with perfect efficiency). Some do. The fact that most don't is probably an hint that it is still more convenient for them to have more visitors even if they don't see or click on ads.

Between script blocking, flash blocking, and using firefox's internal image black list (click on an ad jpg, select 'image info' then click on the box that says to block images from this domain) I don't see %95 of ads anyway. The only ones that get through are ones I allow from sites I like. I figure it is their own fault. If they hadn't made ads annoying, by flashing and whatnot, I wouldn't bother to block them, and if they hadn't mad flash ads annoying by adding sound, then I wouldn't have bothered to get flash block.

[snippage]I will generally pay for those things, incidentally. It's unfortunate that most websites don't even give the option for ad-free subscriptions.

If you don't like the advertising, don't visit the website. You are not entitled to the content of the web without paying for cost of distributing it, usually through advertising. I am amazed by the lengths people go to justify what amounts to stealing bandwidth.

Erm. Where did I write that I block ads? Where did I write, or even imply that I'm entitled to the content of the web for free?

Would you like to clarify and/or apologize, or are you willing to call me a liar and thief to my face?

I was merely lamenting the relative scarcity of legitimate options for people who would like to subscribe to an ad-free version of a site, at any price.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

We bet on the fact not everybody is knowledgable enough to block ads, so the odds our freeloading will destroy the system or cause a website to go bankrupt are negligible.

But if, say, Firefox decided to offer ad-blocking out of the box, either the ad-based system would be destroyed, or there would be a cat-and-mouse game between ad-blocking software and sites trying to make their content unviewable to people surfing with ad-blockers on.

PS: I have whitelisted some sites like arstechnica, but I surf with ad-block on.

it wasn't that long ago that one of the ad networks ars uses was compromised (tried to find the story, but my search terms are too common and i can't remember exactly when the story was written), and it only took a few hours for ars to dump that ad network. most of that delay was waiting for web cache appliances to purge themselves, if i remember right. so no site is immune.

that said, i have whitelisted ars in ABP, as well as all the independent webcomics i read. however, i still have ABP blocking stuff on comics.com, since their ads are hellaciously obnoxious and cause the page to load slower than using a 300 baud modem.

and i thank scott adams for bucking the trend and creating http://dilbert.com/fast when they redesigned dilbert.com into the bloated, hideous beast that it is several years ago.

I tend to let ads be, with the exception of flash (thankfully, now both Seamonkey and Firefox know how to block plugins). But when a page takes forever to load because it can't reach an ad server or stat counter, you can pretty much guarantee those servers get blacklisted.

I have a hard time feeling bad at all for the ad networks. They do everything they can to force ads in my face, drag my attention away from the content I came for, track my every move online, collect all my personal information, etc. etc. So it's only fair that I fight back with the tools at my disposal - ad blockers, tracking blockers, whatever else is available. Yay for AdBlock + Ghostery! Really not different from muting commercials, changing channels, or DVR + FF past commercials.

Most web advertising is actually worse than TV: at least on TV the show and the ads are both video + audio. But most web pages are static text and images while their ads are animated images and video, with the really bad ones playing sound, popping over the page, or even blocking the page itself! When ads stop being so awful, I'll stop blocking them.

The sites I care about I whitelist from adblock (like Ars). Nobody gets whitelisted from tracking blockers. If it breaks a site, I go somewhere else.

Is the "Nest" ad that runs on the mobile version of the site a few times a month "on purpose" or not?

That one is the only thing that annoys me. I have no need for a new thermometer in my rental, and no matter how many times you plop it over an article and make me close it, you are getting no closer to me buying a Nest.

I totally understand the difficulties of getting the same ad revenue off a smaller screen, but some variety would be nice.

To me, the security issue of ad networks allowing the purchaser of ad-space to inject code complicated enough to invade my privacy, steal my data, or redirect me to malicious sites is the most worrisome detail in this article. Granted, it's likely been like that for a while, but this article drives the point home.

I used to feel slightly guilty for using ad-blocking plug-ins in the most convenient way possible, i.e. block everything, because some sites I really like would see fractionally less support as a result. That sense of guilt has almost entirely become a thing of the past now.

And to those of you that feel that the ads and ad networks are justified by the economics involved, I remind you that economics basically involves the study of how money flows due to people's behaviors. So if people behave in a way that causes some business model to fail, it's the model's fault, not the people's.

FTR, there is one site I know of that uses a different model for "ad-like" support - macintouch.com. It uses special Amazon links so that if you make a purchase from Amazon resulting from using those links, macintouch gets a small payment. That is a different model that I wholly support and greatly appreciate. Yes, it likely won't work for larger sites, but the point is that other models can be thought of and implemented.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

I ad-block everything, everywhere, on every site, and I always will.When sites I visit offer a paid subscription, I buy it. If they don't, I see no reason to subsidize the toxic ad model the web is currently stuck with.If sites go down because of that, oh well; they must not have been interesting enough to subscribe to.

Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy?

Outstanding. Can't wait for said system to finish its inevitable implosion. Paid-for-by-advertising is a sucky model with far too many nasty implications and conflicts of interest in it, and the sooner it finishes dying a horrible death, the better.

/dudewhopaysforArsdirectly

It isn't a bad thing at all. "Oh noes conflict of interest!" Really?

I don't care. Some people have zero integrity, but guess what? If the ads are on the page, then at least you have a reason to be suspicious. There's nothing preventing some manufacturer from bribing a journalist (who probably has zero integrity to begin with) to shill their product.

With ads, at least the shilling is visible.

Your lack of understanding of reality is appalling. Being paid for by ads is a GOOD thing for everyone. The creator gets paid, the ad maker gets paid, the company running the ads gets paid when their product gets purchased more often, and the end user didn't have to directly pay to use Google or similar services.

This obviously isn't the point of the story, but it amazes me that so many people are so self-righteous about ads being on web pages. Does it occur to some of you that it's these ads that allow high-quality content to be available to you for free? Does it occur to you that you slowly destroying the system that pays for the sites that we enjoy? Some of you are amazingly short-sighted about this.

I don't object to all ads. I object to the ones that are (1) patently offensive or (2) visually distracting or (3) take up too much bandwidth.